rcf-lite 0.26.0 → 0.28.0

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-023.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "An optional scheduledAudit dimension materialises a cron-triggered workflow running the required check set on cadence",
   "description": "When `workflowShape.scheduledAudit` is `true`, the workflow-materialiser produces a `scheduled-audit` workflow that fires on a cron schedule (the provider's own schedule surface) and runs the same required check set the pull-request and default-branch workflows run. When the field is `false` (default), no scheduled workflow ships. The scheduled-audit workflow writes its aggregate report to a distinct stable path (`.rcf/reports/ci/scheduled-audit.json`) so a scheduled-run outcome never overwrites the most recent commit-triggered outcome downstream readers depend on.",
+  "deliveredBy": {
+    "tacId": "TAC-706-delivery-ci-workflows-scheduled-audit",
+    "field": "interfaces.runScheduledAudit"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6101.json

@@ -11,12 +11,13 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6101-1",
-      "description": "The CI provider's jobs for the commit-triggered workflows are triggered by the trigger events the branch model defines: for feature-branch, pushes to the default branch and pull requests opened, synchronised, or reopened against the default branch; for trunk-based, pushes to the trunk branch and (in the `trunkPullRequests: sometimes` sub-shape) pull requests targeting the trunk branch. The trigger configuration is committed under source control, not set through a provider UI.",
+      "description": "The CI provider's jobs for the commit-triggered workflows are triggered by the trigger events the branch model defines: for feature-branch, pushes to the default branch and pull requests opened, synchronised, or reopened against the default branch; for trunk-based, pushes to the trunk branch and (in the `trunkPullRequests: sometimes` sub-shape) pull requests targeting the trunk branch. The trigger configuration is committed under source control, not set through a provider UI. Template values the applying agent sets: The applying agent sets the elicited report directory; the AC substitutes the project's path for the illustrative default.",
       "given": "the project's materialised workflow files and repository state at the head commit",
       "when": "a trigger event fires that the elicited branch model names",
       "then": "the aggregate pipeline report at the configured stable path (default `.rcf/reports/ci/pipeline.json`) is written by the resulting CI job, and its `trigger` field records the event kind and the workflow that ran",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6101-2",
@@ -25,7 +26,22 @@
       "when": "the operator or an automated merge tool attempts to admit the change through the standard merge or push path",
       "then": "the platform refuses the change, and the refusal reason references the failed required check that corresponds to the workflow that ran",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-6101-3",
+      "description": "A workflow whose trigger set omits one of the required events (a pull-request-checks workflow with only `push`) is refused at materialise-time with WORKFLOW_TRIGGER_INCOMPLETE naming the missing trigger; no workflow file is written.",
+      "given": "a workflowShape configuration whose materialised trigger set for a required workflow drops one of the required triggers",
+      "when": "the materialiser runs",
+      "then": "the process exits with a non-zero code and emits WORKFLOW_TRIGGER_INCOMPLETE naming the missing trigger and the workflow name; the workflow directory is unchanged",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+        "field": "interfaces.materialise"
+      }
     }
   ],
   "tacIds": [
@@ -33,5 +49,5 @@
     "TAC-703-delivery-ci-workflows-aggregate-report"
   ],
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6102.json

@@ -16,7 +16,8 @@
       "when": "the aggregate report is written by any CI run",
       "then": "the aggregate report's `runner.entryPoint` field records a project-relative path to a `.js` or `.mjs` file that exists at that path in the tree",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-6102-2",
@@ -25,12 +26,27 @@
       "when": "an operator reads the job step that produces the pipeline report",
       "then": "the step is a single-line invocation of the Node entry point (or an equivalent package-manager script), and every gate-level branching, timing, and report-writing responsibility lives inside the Node runner rather than the CI configuration",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-6102-3",
+      "description": "A gate that names an unknown executable in its command array (a `command[0]` that does not resolve on the PATH) is refused at gate spawn with a stable-coded GATE_SPAWN_FAILED naming the executable and the gate name; the runner does not continue with other gates until the operator resolves.",
+      "given": "a gate descriptor with command [\"nonexistent-bin\",\"arg\"] and a runner invoked against the descriptor",
+      "when": "the runner attempts to spawn the gate",
+      "then": "the gate reports failed with GATE_SPAWN_FAILED naming the executable and the gate; the per-gate report is written failed; the aggregate reflects the failure",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+        "field": "interfaces.runGates"
+      }
     }
   ],
   "tacIds": [
     "TAC-701-delivery-ci-workflows-gate-runner"
   ],
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6103.json

@@ -11,12 +11,13 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6103-1",
-      "description": "The suite invokes `rcf define validate` before any other gate. The gate's exit code, captured stdout, and captured stderr are written to a per-gate report at the configured stable path.",
+      "description": "The suite invokes `rcf define validate` before any other gate. The gate's exit code, captured stdout, and captured stderr are written to a per-gate report at the configured stable path. Template values the applying agent sets: The applying agent sets the elicited report directory; the AC substitutes the project's path for the illustrative default.",
       "given": "the pipeline has run against the head commit",
       "when": "the reviewer opens the per-gate report file at `<reportDir>/validate.json`",
       "then": "the file exists, its `gate` field is `validate`, its `command` field names the `rcf define validate` invocation, its `exitCode` field records the underlying process exit code, and its `stdout` and `stderr` fields carry the captured streams",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6103-2",
@@ -25,7 +26,22 @@
       "when": "the suite completes",
       "then": "the aggregate report's `verdict` field is `failed`, its `gates[]` entry for `validate` records `outcome: failed`, and the Node entry point's process exit code is non-zero",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-6103-3",
+      "description": "The validate gate exit code carries through to the pipeline: a validate command that returns exit 5 marks the gate failed with a per-gate report that records the exit code and the failing command; the aggregate refuses pipeline pass.",
+      "given": "a validate gate configured to run a stub that exits 5",
+      "when": "the runner invokes it",
+      "then": "the per-gate report writes verdict=failed with exitCode=5 and the command name; the aggregate refuses pipeline pass",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-702-delivery-ci-workflows-gate-report",
+        "field": "interfaces.writeGateReport"
+      }
     }
   ],
   "tacIds": [
@@ -33,5 +49,5 @@
     "TAC-702-delivery-ci-workflows-gate-report"
   ],
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6104.json

@@ -11,12 +11,13 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6104-1",
-      "description": "The suite invokes `rcf audit coverage --strict` as a required gate after `rcf define validate`. The gate's exit code, captured stdout, and captured stderr are written to a per-gate report at the configured stable path.",
+      "description": "The suite invokes `rcf audit coverage --strict` as a required gate after `rcf define validate`. The gate's exit code, captured stdout, and captured stderr are written to a per-gate report at the configured stable path. Template values the applying agent sets: The applying agent sets the elicited report directory; the AC substitutes the project's path for the illustrative default.",
       "given": "the pipeline has run against the head commit",
       "when": "the reviewer opens the per-gate report file at `<reportDir>/coverage-strict.json`",
       "then": "the file exists, its `gate` field is `coverage-strict`, its `command` field names the `rcf audit coverage --strict` invocation, its `exitCode` field records the underlying process exit code, and its `stdout` and `stderr` fields carry the captured streams",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6104-2",
@@ -25,7 +26,22 @@
       "when": "the suite completes",
       "then": "the aggregate report's `verdict` field is `failed`, its `gates[]` entry for `coverage-strict` records `outcome: failed` with the underlying exit code preserved, and no gate report on disk records a shallow-any invocation for coverage",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-6104-3",
+      "description": "The strict coverage gate refuses to declare a pass when an AC has no resolving TC even if every other AC is covered; the per-gate report names the uncovered AC id and the aggregate refuses pipeline pass.",
+      "given": "a project tree where AC-999-x has no resolving TC and every other AC does",
+      "when": "the strict coverage gate runs",
+      "then": "the gate exits non-zero, the per-gate report names AC-999-x under uncovered, and the aggregate carries verdict=failed",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+        "field": "interfaces.runGates"
+      }
     }
   ],
   "tacIds": [
@@ -33,5 +49,5 @@
     "TAC-702-delivery-ci-workflows-gate-report"
   ],
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6105.json

@@ -11,12 +11,13 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6105-1",
-      "description": "Every gate the suite runs writes a JSON report file at `<reportDir>/<gate>.json` whether the gate passed or failed. The report carries a fixed set of fields: `gate`, `command`, `toolVersion`, `startedAt`, `endedAt`, `durationMs`, `exitCode`, `outcome`, `stdout`, `stderr`, and (v2 addition) `checkKind`.",
+      "description": "Every gate the suite runs writes a JSON report file at `<reportDir>/<gate>.json` whether the gate passed or failed. The report carries a fixed set of fields: `gate`, `command`, `toolVersion`, `startedAt`, `endedAt`, `durationMs`, `exitCode`, `outcome`, `stdout`, `stderr`, and (v2 addition) `checkKind`. Template values the applying agent sets: The applying agent sets the elicited report directory; the AC substitutes the project's path for the illustrative default.",
       "given": "the suite has run against any tree",
       "when": "the reviewer inspects the configured report directory after the run",
       "then": "for every gate named in the aggregate report's `gates[]` array, a file at `<reportDir>/<gate>.json` exists whose top-level keys are exactly the fixed set above, and the value types match the stable schema (`startedAt` and `endedAt` are ISO-8601 strings, `durationMs` is an integer, `exitCode` is an integer, `outcome` is one of `passed` or `failed`, `checkKind` is one of `validate`, `coverage-strict`, `linter`, `formatter`, `typecheck`, `unitTest`, `securityScan`, or a `custom:<name>` string)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6105-2",
@@ -25,12 +26,27 @@
       "when": "the reviewer diffs the two runs' per-gate reports",
       "then": "the `toolVersion` field in the affected per-gate reports differs between the two runs, and the value on each side matches what the invoked `rcf --version` prints on that host",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-6105-3",
+      "description": "An interrupted per-gate report rewrite (SIGKILL of the gate runner mid-write) never leaves a stale passing report standing for the current run: after interruption, a follow-up gate invocation on the same reportDir sees the previous report either fully replaced by the new one OR absent, never partially rewritten and never a stale success. Template values the applying agent sets: The applying agent supplies the elicited reportDir path; the AC substitutes it for the illustrative default.",
+      "given": "a reportDir containing a passing per-gate report from a previous run and a gate about to fail on the current run",
+      "when": "the gate runner is SIGKILLed mid-way through writing the new per-gate report, then a follow-up invocation reads the reportDir",
+      "then": "the follow-up invocation either finds the new failing report or no report at all for the interrupted gate; a subsequent aggregate step treats an absent report as missing per REQ-008; the previous run's passing report never survives the current run",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-702-delivery-ci-workflows-gate-report",
+        "field": "responsibilities[3]"
+      }
     }
   ],
   "tacIds": [
     "TAC-702-delivery-ci-workflows-gate-report"
   ],
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6106.json

@@ -11,12 +11,13 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6106-1",
-      "description": "The suite writes an aggregate report at `<reportDir>/pipeline.json` on every run. The aggregate carries `verdict`, `trigger`, `startedAt`, `endedAt`, `durationMs`, `runner.entryPoint`, and `gates[]` (each entry naming `gate`, `outcome`, `durationMs`, and `reportPath`).",
+      "description": "The suite writes an aggregate report at `<reportDir>/pipeline.json` on every run. The aggregate carries `verdict`, `trigger`, `startedAt`, `endedAt`, `durationMs`, `runner.entryPoint`, and `gates[]` (each entry naming `gate`, `outcome`, `durationMs`, and `reportPath`). Template values the applying agent sets: The applying agent sets the elicited report directory; the AC substitutes the project's path for the illustrative default.",
       "given": "the suite has run against any tree",
       "when": "the reviewer opens `<reportDir>/pipeline.json`",
       "then": "the file exists, its top-level keys are exactly the fixed set above, `verdict` is one of `passed` or `failed`, `gates[]` is a non-empty array in fixed configured order, and every `reportPath` value resolves to an existing per-gate report file at that relative path",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6106-2",
@@ -25,12 +26,27 @@
       "when": "the reviewer reads the aggregate report",
       "then": "the aggregate report's `verdict` field is `failed`, and the aggregate does not record `passed` while any per-gate entry recorded a non-`passed` outcome",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-6106-3",
+      "description": "The aggregate report writer refuses to overwrite a report path that resolves outside the elicited report directory (an attempted path traversal) with the stable code AGGREGATE_PATH_ESCAPE naming the offending path; the target file is not written.",
+      "given": "an aggregate writer invoked with a computed path that resolves outside the elicited report-dir (a symlink loop, a path traversal ../)",
+      "when": "the writer runs",
+      "then": "the writer refuses with AGGREGATE_PATH_ESCAPE naming the offending resolution; no bytes are written to the target",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-703-delivery-ci-workflows-aggregate-report",
+        "field": "interfaces.writeAggregateReport"
+      }
     }
   ],
   "tacIds": [
     "TAC-703-delivery-ci-workflows-aggregate-report"
   ],
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6107.json

@@ -11,12 +11,13 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6107-1",
-      "description": "On any gate failure, the Node entry point writes an operator-readable failure summary to its own stderr naming the failing gate, its exit code, and the relative path to the per-gate report file.",
+      "description": "On any gate failure, the Node entry point writes an operator-readable failure summary to its own stderr naming the failing gate, its exit code, and the relative path to the per-gate report file. Template values the applying agent sets: The applying agent sets the elicited report directory; the AC substitutes the project's path for the illustrative default.",
       "given": "an invocation of the suite whose `validate` (or any) gate fails",
       "when": "the reviewer reads the runner-log tail (the Node process's own stderr)",
       "then": "the tail contains a single-line summary matching the shape `[delivery-ci-workflows] gate '<gate>' failed (exit <n>); report: <reportDir>/<gate>.json`, and the reference report file exists at the named path",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6107-2",
@@ -25,7 +26,22 @@
       "when": "the suite completes",
       "then": "the aggregate report's `gates[]` array contains both `validate` and `coverage-strict` entries, each with `outcome: failed`, and each with a `reportPath` value pointing to an existing per-gate report file",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-6107-3",
+      "description": "The operator-visible message on a gate failure names the failing gate first line, the failing command second line, and the per-gate report path third line; the format is stable across runs so downstream log parsers key on the shape.",
+      "given": "a run in which the linter gate fails",
+      "when": "the runner writes to stderr",
+      "then": "stderr's last three non-empty lines match the pattern gate:<name>, command:<argv>, report:<path>",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+        "field": "interfaces.runGates"
+      }
     }
   ],
   "tacIds": [
@@ -33,5 +49,5 @@
     "TAC-703-delivery-ci-workflows-aggregate-report"
   ],
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6108.json

@@ -11,12 +11,13 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6108-1",
-      "description": "The aggregate report records the fixed configured set of required gates as its `gates[]` array in configured order. A required gate whose per-gate report file was not written during the run is recorded in the array with `outcome: missing` and a `reason` field naming the failure mode.",
+      "description": "The aggregate report records the fixed configured set of required gates as its `gates[]` array in configured order. A required gate whose per-gate report file was not written during the run is recorded in the array with `outcome: missing` and a `reason` field naming the failure mode. Template values the applying agent sets: The applying agent sets the elicited report directory; the AC substitutes the project's path for the illustrative default.",
       "given": "a suite invocation in which the `coverage-strict` gate's Node child process was killed before its report could be written (or the report directory was not writable, or the child exited with an uncaught exception)",
       "when": "the aggregate report is written at the end of the run",
       "then": "the aggregate report's `gates[]` array contains a `coverage-strict` entry with `outcome: missing`, its `reason` field carries a non-empty string, and the aggregate `verdict` is `failed`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6108-2",
@@ -25,7 +26,22 @@
       "when": "the Node entry point completes",
       "then": "the process exit code is non-zero, and the aggregate report's `verdict` is `failed`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-6108-3",
+      "description": "An interrupted aggregate report rewrite (SIGKILL of the aggregate step mid-write) never leaves a stale passing aggregate standing for the current run: after interruption, the aggregate is either the current run's fully-written value OR absent; the pipeline treats an absent aggregate as missing per REQ-008 and refuses a pipeline pass. Template values the applying agent sets: The applying agent supplies the elicited reportDir path; the AC substitutes it for the illustrative default.",
+      "given": "a reportDir containing a passing aggregate from a previous run and an aggregate step about to write for the current run",
+      "when": "the aggregate writer is SIGKILLed mid-way through writing, then the pipeline evaluates the aggregate",
+      "then": "the aggregate is either the new run's fully-written value or absent; the pipeline refuses the pass when absent; the previous run's aggregate never survives",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-703-delivery-ci-workflows-aggregate-report",
+        "field": "responsibilities[3]"
+      }
     }
   ],
   "tacIds": [
@@ -33,5 +49,5 @@
     "TAC-703-delivery-ci-workflows-aggregate-report"
   ],
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6109.json

@@ -11,26 +11,33 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6109-1",
-      "description": "The applied blueprint's source path (recorded on `manifest.blueprints[delivery-ci-workflows].source`) contains one illustrative GitHub Actions workflow file per workflow in the matrix under `assets/ci-provider-examples/github-actions/`. At the widest shape the files are `pull-request-checks.yml`, `default-branch-checks.yml`, `release.yml`, and `scheduled-audit.yml`. Each workflow defines the required trigger set for its workflow, sets up Node and the package manager, installs dependencies, invokes the corresponding Node entry point as a single command line, and uploads the corresponding report directory or file as a workflow artefact.",
+      "description": "The applied blueprint's source path (recorded on `manifest.blueprints[delivery-ci-workflows].source`) contains one illustrative GitHub Actions workflow file per workflow in the matrix under `assets/ci-provider-examples/github-actions/`. At the widest shape the files are `pull-request-checks.yml`, `default-branch-checks.yml`, `release.yml`, and `scheduled-audit.yml`. Each workflow defines the required trigger set for its workflow, sets up Node and the package manager, installs dependencies, invokes the corresponding Node entry point as a single command line, and uploads the corresponding report directory or file as a workflow artefact. Template values the applying agent sets: The applying agent sets the elicited providerHint; the AC substitutes the project's provider assets for the illustrative GitHub-Actions asset set.",
       "given": "an rcf-lite project that has applied this blueprint",
       "when": "the operator opens the blueprint's source path and reads the files under `assets/ci-provider-examples/github-actions/`",
       "then": "the four workflow files exist at that path, each file's `on:` block names the trigger set corresponding to its workflow, each file's steps include a Node setup and a package-manager setup, one step per file invokes the appropriate Node entry point as a single `node <path>` line (or a package-manager script that resolves to the same), and a final step uploads the corresponding report path as a workflow artefact",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6109-2",
-      "description": "The applied blueprint's guide names GitLab CI, CircleCI, Buildkite, and Jenkins as equally supported providers, states the mapping (job trigger, Node setup, single-line entry-point invocation, artefact upload) applied to each workflow in the matrix, and states that the blueprint does not ship provider-specific configuration for those runners in v2.0.0.",
+      "description": "The applied blueprint's guide names GitLab CI, CircleCI, Buildkite, and Jenkins as equally supported providers, states the mapping (job trigger, Node setup, single-line entry-point invocation, artefact upload) applied to each workflow in the matrix, and states that the blueprint does not ship provider-specific configuration for those runners in v2.0.0. Template values the applying agent sets: The applying agent sets the elicited providerHint; the AC substitutes the project's provider assets for the illustrative GitHub-Actions asset set.",
+      "ownerRef": {
+        "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+        "field": "interfaces[2].name"
+      },
       "given": "an rcf-lite project that has applied this blueprint",
       "when": "the operator opens `guide/delivery-ci-workflows.md` from the blueprint's source path",
       "then": "the guide's `when to reach for it` or an adjacent section names GitLab CI, CircleCI, Buildkite, and Jenkins by name, describes the four mapping points applied to each workflow the matrix materialises, and states that no provider-specific configuration file for those runners is shipped by the blueprint at v2.0.0",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
     "TAC-701-delivery-ci-workflows-gate-runner"
   ],
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "description": "Section 7a floor: two ACs. Guide and TAC-701 name no US-6109-specific failure paths beyond runner-missing (covered generically by AC-6102-3 unknown-executable refusal) and gate-aggregation gaps (covered by AC-6108-1 required-gate listing); this story owns the shipped GHA illustrative assets and the alternate-provider mapping documentation (per REQ-009 and assets/ci-provider-examples/notes.md)."
 }

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6110.json

@@ -11,26 +11,42 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6110-1",
-      "description": "The CI provider's job step invokes the Node entry point with the same command a developer runs locally: the same file path, the same required arguments, the same environment variables the entry point reads (report directory path, tool-version pin). No CI-only wrapper script sits between the runner and the Node entry point.",
+      "description": "The CI provider's job step invokes the Node entry point with the same command a developer runs locally: the same file path, the same required arguments, the same environment variables the entry point reads (report directory path, tool-version pin). No CI-only wrapper script sits between the runner and the Node entry point. Template values the applying agent sets: The applying agent sets the elicited report directory; the AC substitutes the project's path for the illustrative default.",
       "given": "an rcf-lite project with this blueprint applied and a CI job wired per the illustrative example",
       "when": "a developer runs the same command line the CI job's invocation step records against their local checkout at the same commit",
       "then": "the aggregate report the local run writes at the configured report directory carries the same `runner.entryPoint`, the same `gates[]` ordering, and the same per-gate outcomes as the CI run's aggregate report for that commit, given the same rcf CLI version installed locally",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6110-2",
-      "description": "The gate entry point reads no CI-provider-specific environment variable to alter its behaviour. Every configuration input the entry point honours is documented and available to a developer running locally.",
+      "description": "The gate entry point reads no CI-provider-specific environment variable to alter its behaviour. Every configuration input the entry point honours is documented and available to a developer running locally. Template values the applying agent sets: The applying agent sets the elicited providerHint; the AC substitutes the project's provider assets for the illustrative GitHub-Actions asset set.",
       "given": "the applied blueprint's source path and the project's realised gate entry point",
       "when": "the reviewer greps the entry point's source and its dependency modules for reads against known CI-provider environment variables (`GITHUB_ACTIONS`, `GITLAB_CI`, `CIRCLECI`, `BUILDKITE`, `JENKINS_URL`)",
       "then": "no read of any of those variables gates the entry point's control flow or its gate set; if any such variable is read it is only for reporting into the aggregate report's `runner.environment` metadata field",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-6110-3",
+      "description": "A gate that produces different exit codes locally versus in CI (a stateful runner that reads process.env.CI) fails the parity assertion: the local invocation and the CI invocation must produce equal per-gate JSON reports (excluding wall-clock durations); a difference is flagged as a parity defect the operator resolves at the gate implementation, not by tolerating drift.",
+      "given": "a gate whose exit code depends on process.env.CI (returns 0 locally, 1 in CI)",
+      "when": "the same tree is run locally and under CI=1",
+      "then": "the per-gate reports differ in verdict; the runner's parity-check flag (documented) marks the drift and the operator is directed to remove the CI-dependent branch from the gate",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+        "field": "interfaces.runGates"
+      }
     }
   ],
   "tacIds": [
     "TAC-701-delivery-ci-workflows-gate-runner"
   ],
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6111.json

@@ -11,26 +11,42 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6111-1",
-      "description": "The workflow-materialiser reads its input `workflowShape` from the stable path `.rcf/config/delivery-ci-workflows.json` on the project tree. The reader path is documented in the blueprint guide and does not vary with CI provider.",
+      "description": "The workflow-materialiser reads its input `workflowShape` from the stable path `.rcf/config/delivery-ci-workflows.json` on the project tree. The reader path is documented in the blueprint guide and does not vary with CI provider. Template values the applying agent sets: The applying agent sets the workflowShape elicits (checkSet, branchModel, releaseMode, scheduledAudit, providerHint); the AC substitutes the project's declaration for the illustrative shape values.",
       "given": "a project that has applied delivery-ci-workflows v2 and populated `.rcf/config/delivery-ci-workflows.json`",
       "when": "the workflow-materialiser runs (locally or in CI)",
       "then": "the materialiser reads the file at the documented path and treats its `workflowShape` as authoritative",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6111-2",
-      "description": "The three required fields (`branchModel`, `checkSet`, `providerHint`), the optional `releaseMode` field (absent has the same effect as `releaseMode: none`, per Q6-B ratification), the optional `scheduledAudit` field, the optional `trunkPullRequests` sub-field, and the optional substitution-surface fields `defaultBranch` (default `main`), `trunkBranch` (default `main`), and `packageManager` (default `pnpm`; recognised set `pnpm`, `npm`, `yarn`, `bun`) are the complete surface the workflow-materialiser reads. No other field the file carries is interpreted at this version; unknown fields are ignored (forward-compatibility).",
+      "description": "The three required fields (`branchModel`, `checkSet`, `providerHint`), the optional `releaseMode` field (absent has the same effect as `releaseMode: none`, per Q6-B ratification), the optional `scheduledAudit` field, the optional `trunkPullRequests` sub-field, and the optional substitution-surface fields `defaultBranch` (default `main`), `trunkBranch` (default `main`), and `packageManager` (default `pnpm`; recognised set `pnpm`, `npm`, `yarn`, `bun`) are the complete surface the workflow-materialiser reads. No other field the file carries is interpreted at this version; unknown fields are ignored (forward-compatibility). Template values the applying agent sets: The applying agent sets the workflowShape elicits (checkSet, branchModel, releaseMode, scheduledAudit, providerHint); the AC substitutes the project's declaration for the illustrative shape values.",
       "given": "a `workflowShape` declaration carrying the three required fields, the optional fields, and additional unknown fields",
       "when": "the workflow-materialiser reads the file",
       "then": "the materialiser processes the recognised fields (including the substitution-surface trio) and ignores the unknown fields without failing the boot-check",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-6111-3",
+      "description": "A workflowShape configuration whose branchModel is `trunk` but whose materialised outputs still write a pull-request-checks workflow (drift from ADR-706 defaults) fails a materialiser self-check: the writer refuses with WORKFLOW_SHAPE_MISMATCH naming branchModel and the extra file. Prevents silent divergence from the ratified shape mapping. Template values the applying agent sets: The applying agent sets the elicited workflowShape.branchModel; the AC substitutes the project's branch model for the illustrative trunk and the writer-refused file for pull-request-checks.yml.",
+      "given": "a materialiser invoked with branchModel=trunk and a stub that would still emit pull-request-checks.yml",
+      "when": "the materialiser runs its self-check",
+      "then": "the writer refuses with WORKFLOW_SHAPE_MISMATCH naming branchModel=trunk and the pull-request-checks.yml file; nothing is written",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+        "field": "interfaces.materialise"
+      }
     }
   ],
   "tacIds": [
     "TAC-704-delivery-ci-workflows-workflow-materialiser"
   ],
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6112.json

@@ -11,26 +11,56 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6112-1",
-      "description": "A `workflowShape` missing any of the three required fields (`branchModel`, `checkSet`, `providerHint`) causes the workflow-materialiser to exit non-zero with a stable error code and a message naming the missing field. `releaseMode` being absent does NOT fail the boot-check (per Q6-B ratification): the materialiser treats absent `releaseMode` as `releaseMode: none` and ships no release workflow. No workflow file is written when the boot-check does fail.",
+      "description": "A `workflowShape` missing any of the three required fields (`branchModel`, `checkSet`, `providerHint`) causes the workflow-materialiser to exit non-zero with a stable error code and a message naming the missing field. `releaseMode` being absent does NOT fail the boot-check (per Q6-B ratification): the materialiser treats absent `releaseMode` as `releaseMode: none` and ships no release workflow. No workflow file is written when the boot-check does fail. Template values the applying agent sets: The applying agent sets the workflowShape elicits (checkSet, branchModel, releaseMode, scheduledAudit, providerHint); the AC substitutes the project's declaration for the illustrative shape values.",
       "given": "a `workflowShape` declaration whose `providerHint` field is absent (or any of the three required fields)",
       "when": "the workflow-materialiser boots",
       "then": "the materialiser exits non-zero, prints an error naming the missing field with a stable code, and leaves the provider's workflow directory unchanged",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6112-2",
-      "description": "A required field whose value is not in the recognised enumeration for that field causes the same failure shape: non-zero exit, stable-coded error, no workflow file written.",
+      "description": "A required field whose value is not in the recognised enumeration for that field causes the same failure shape: non-zero exit, stable-coded error, no workflow file written. Template values the applying agent sets: The applying agent sets the workflowShape elicits (checkSet, branchModel, releaseMode, scheduledAudit, providerHint); the AC substitutes the project's declaration for the illustrative shape values.",
       "given": "a `workflowShape` carrying `branchModel: hybrid` (a value the enumeration does not include)",
       "when": "the workflow-materialiser boots",
       "then": "the materialiser exits non-zero, prints an error naming the field, the value received, and the recognised set, with a stable code",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-6112-3",
+      "description": "An absent .rcf/config/delivery-ci-workflows.json file is refused at materialise-time with a stable-coded WORKFLOW_CONFIG_MISSING naming the expected path; no workflow file is written to the workflow directory.",
+      "given": "a project tree that has never applied a workflow shape (no .rcf/config/delivery-ci-workflows.json)",
+      "when": "the workflow-materialiser runs",
+      "then": "the materialiser exits with a non-zero code and emits WORKFLOW_CONFIG_MISSING naming the expected path; the workflow directory is unchanged",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+        "field": "responsibilities[0]"
+      }
+    },
+    {
+      "id": "AC-6112-4",
+      "description": "An unparseable .rcf/config/delivery-ci-workflows.json (invalid JSON) is refused at materialise-time with a stable-coded WORKFLOW_CONFIG_UNPARSEABLE naming the file path and the parser error; no workflow file is written.",
+      "given": "a project tree with .rcf/config/delivery-ci-workflows.json containing invalid JSON (e.g. a trailing comma before EOF)",
+      "when": "the workflow-materialiser runs",
+      "then": "the materialiser exits with a non-zero code and emits WORKFLOW_CONFIG_UNPARSEABLE naming the file path and the parser error position; the workflow directory is unchanged",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+        "field": "responsibilities[0]"
+      }
     }
   ],
   "tacIds": [
     "TAC-704-delivery-ci-workflows-workflow-materialiser"
   ],
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }